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REMARKS 

The Office Action dated October 13, 2009, has been received 
and carefully considered. In this response, claims 1-3 and 36- 
38 have been amended. No new matter has been added. Entry of 
the amendments to claims 1-3 and 36-38 is respectfully 
requested. Reconsideration of the pending rejections in the 
present application is also respectfully requested based on the 
following remarks. 1 

I . THE OBVIOUSNESS REJECTION OF CLAIMS 1-6, 18, 37, AND 38 

On pages 3-5 of the Office Action, claims 1-6, 18, 37, and 
38 were rejected under 35 U.S.C. § 103(a) as being unpatentable 
over U.S. Patent Application Publication No. US2003/0065926A1 to 
Schultz et al. ("Schultz") in view of U.S. Patent No. 7,210,04 0 
to Jordan ("Jordan") . This rejection is hereby respectfully 
traversed. 

Under 35 U.S.C. § 103, the Patent Office bears the burden 
of establishing a prima facie case of obviousness. In re Fine , 

1 As Applicant's remarks with respect to the Examiner's rejections are 
sufficient to overcome these rejections, Applicant's silence as to assertions 
made by the Examiner in the Office Action or certain requirements that may be 
applicable to such rejections (e.g., assertions regarding dependent claims, 
whether a reference constitutes prior art, whether references are legally 
combinable for obviousness purposes) is not a concession by Applicant that 
such assertions are accurate or such requirements have been met, and 
Applicant reserves the right to analyze and dispute such in the future. 
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837 F.2d 1071, 1074 (Fed. Cir. 1988). There are four separate 

factual inquiries to consider in making an obviousness 

determination: (1) the scope and content of the prior art; (2) 

the level of ordinary skill in the field of the invention; (3) 

the differences between the claimed invention and the prior art; 

and (4) the existence of any objective evidence, or "secondary 

considerations," of non-obviousness. Graham v. John Deere Co. , 

383 U.S. 1, 17-18 (1966); see also KSR Int'l Co. v. Teleflex 

Inc . , 127 S. Ct. 1727 (2007) . An "expansive and flexible 

approach" should be applied when determining obviousness based 

on a combination of prior art references. KSR , 127 S. Ct . at 

1739. However, a claimed invention combining multiple known 

elements is not rendered obvious simply because each element was 

known independently in the prior art. Id. at 1741. Rather, 

there must still be some "reason that would have prompted" a 

person of ordinary skill in the art to combine the elements in 

the specific way that he or she did. Id.; In re Icon Health & 

Fitness, Inc. , 496 F.3d 1374, 1380 (Fed. Cir. 2007). Also, 

modification of a prior art reference may be obvious only if 

there exists a reason that would have prompted a person of 

ordinary skill to make the change. KSR, 127 S. Ct . at 174 0-41. 

Regarding claim 1, the Examiner asserts that the claimed 

invention would have been obvious in view of Schultz and Jordan. 
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Applicant respectfully disagrees. However, in order to forward 

the present application toward allowance, Applicant has amended 

claim 1 to more specifically define the claimed invention, and 

specifically those features that further differentiate the 

claimed invention from Schultz and Jordan, as well as the other 

cited references. In particular, Applicant respectfully submits 

that Schultz and Jordan, either alone or in combination, fail to 

disclose, or even suggest, a method for providing computer 

security comprising: determining, using a processor, whether an 

executable associated with a static state meets one or more 

first predetermined criteria; associating a first risk level 

with the executable based upon whether the executable meets the 

one or more first predetermined criteria; determining whether a 

current process associated with the executable meets one or more 

second predetermined criteria ; associating a second risk level 

with the current process based upon whether the current process 

meets the one or more second predetermined criteria, wherein the 

current process is initially associated with the first risk 

level, and wherein the first risk level is updated to the second 

risk level for the current process based upon whether the 

current process meets the one or more second predetermined 

criteria ; and performing a predetermined responsive action with 

respect to the process if the second risk level exceeds a threat 
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detection threshold; wherein determining whether the executable 

meets the one or more first predetermined criteria does not 

comprise comparing the executable with a virus signature, as 

presently claimed. 

In contrast, Schultz discloses detecting malicious 

executables by analyzing byte sequences extracted from the 

binary code of such executables and applying a set of detection 

rules designed to detect sequences associated with malicious 

code. See, e.g., paragraphs [0104] - [0106] and [0109]. 

Executables for which a definitive determination cannot be made 

using existing rules are designated as borderline. See, e.g., 

paragraph [0098] . In Schultz, the rule set is updated 

periodically, based on offline analysis by experts of the 

borderline executables. See, e.g., paragraphs [0107] and 

[0108] . The analysis described by Schultz is performed 

statically on binary code comprising the executable, prior to 

the executable being allowed to execute on a system to which it 

has been sent. Purely static analysis (i.e., not while the 

executable is executing) , with, periodic offline refinement of a 

set of rules used to perform the static analysis, is not the 

same as " determining whether a current process associated with 

the executable meets one or more second predetermined criteria , " 

and " associating a second risk level with the current process 
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based upon whether the current process meets the one or more 

second predetermined criteria, wherein the current process is 

initially associated with the first risk level, and wherein the 

first risk level is updated to the second risk level for the 

current process based upon whether the current process meets the 

one or more second predetermined criteria ," as recited in claim 

1. 

Also, Jordan discloses a system for detecting computer 
viruses that includes an emulator. In Jordan, the "[e]xecution 
of computer executable code in a subject file is emulated by 
emulator 31." See, column 5, lines 36-38. Jordan explains that 
n [w]hile the program file is being emulated, monitor component 
32 monitors the code execution . . . [and] detector component 33 
detects an attempt by the emulated code to access one or more of 
the restricted computer system resources." See, column 5, lines 
38-47. Emulating the execution of executable code in a file 
(which requires the presence of an emulator) is not the same as 
" determining whether a current process associated with the 
executable meets one or more second predetermined criteria , " and 
" associating a second risk level with the current process based 
upon whether the current process meets the one or more second 
predetermined criteria, wherein the current process is initially 
associated with the first risk level, and wherein the first risk 
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level is updated to the second risk level for the current 

process based upon whether the current process meets the one or 

more second predetermined criteria ," as recited in claim 1. 

Further, the Examiner indicates in his remarks that claim 1 
is not specific regarding the execution environment for the 
executable. However, Applicant notes that this issue is moot as 
both Schultz and Jordan fail to disclose, or even suggest, 
" associating a second risk level with the current process based 
upon whether the current process meets the one or more second 
predetermined criteria, wherein the current process is initially 
associated with the first risk level, and wherein the first risk 
level is updated to the second risk level for the current 
process based upon whether the current process meets the one or 
more second predetermined criteria ," as recited in claim 1. 

At this point, Applicant respectfully notes that, as stated 
in MPEP § 2143.03, to establish prima facie obviousness of a 
claimed invention, all the claim limitations must be taught or 
suggested by the prior art. In re Royka , 490 F.2d 981 (CCPA 
1974). That is, " [a] 11 words in a claim must be considered in 
judging the patentability of that claim against the prior art." 
In re Wilson , 424 F.2d 1382 (CCPA 1970). Also, as stated in 
MPEP § 2141.02, in determining the differences between the prior 
art and the claims, the question under 35 U.S.C. 103 is not 
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whether the differences themselves would have been obvious, but 

whether the claimed invention as a whole would have been 

obvious. Distilling an invention down to the "gist" or "thrust" 

of an invention disregards the requirement of analyzing the 

subject matter "as a whole." W.L. Gore & Associates, Inc. v. 

Garlock, Inc. , 721 F.2d 1540 (Fed. Cir. 1983), cert, denied, 469 

U.S. 851 (1984). Further, as stated in MPEP § 2141.02, "[A] 

patentable invention may lie in the discovery of the source of a 

problem even though the remedy may be obvious once the source of 

the problem is identified. This is part of the "subject matter 

as a whole" which should always be considered in determining the 

obviousness of an invention under 35 U.S.C. § 103." In re 

Sponnoble , 405 F.2d 578, 585 (CCPA 1969). 

In view of the foregoing, Applicant respectfully submits 
that claim 1 should be allowable over Schultz and Jordan. 

Regarding claims 3 7 and 38, while different in overall 
scope from claim 1, these claims recite subject matter related 
to claim 1. Thus, the arguments set forth above with respect to 
claim 1 are equally applicable to claims 37 and 38. 
Accordingly, Applicant respectfully submits that claims 3 7 and 
3 8 should be allowable over Schultz and Jordan for the same 
reasons as set forth above with respect to claim 1. 
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Regarding claims 2-6 and 18, these claims are dependent 

upon independent claim 1. If an independent claim is nonobvious 

under 35 U.S.C. 103, then any claim depending therefrom is 

nonobvious. In re Fine , 837 F.2d 1071 (Fed. Cir. 1988) . Thus, 

since independent claim 1 should be allowable as discussed 

above, claims 2-6 and 18 should also be allowable at least by 

virtue of their dependency on independent claim 1. Moreover, 

these claims recite additional features which are not disclosed, 

or even suggested, by the cited references taken either alone or 

in combination. 

In view of the foregoing, Applicant respectfully requests 
that the aforementioned obviousness rejection of claims 1-6, 18, 
37, and 38 be withdrawn. 

II . THE OBVIOUSNESS REJECTION OF CLAIMS 7, 8, 10, 12-17, 29-34 

On pages 6-12 of the Office Action, claims 7, 8, 10, 12-17, 
and 29-34 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent Application Publication No. 
US2003/0065926A1 to Schultz et al . ("Schultz") in view of U.S. 
Patent No. 7,210,04 0 to Jordan ("Jordan") further in view of 
U.S. Patent Application Publication No. US2004/0143749A1 to 
Tajalli et al. ("Tajalli"). This rejection is hereby 

respectfully traversed. 
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Applicant respectfully submits that the aforementioned 

obviousness rejection of claims 7, 8, 10, 12-17, and 29-34 has 

become moot in view of the deficiencies of the primary 

references (i.e., Schultz and Jordan) as discussed above with 

respect to independent claim 1. That is, claims 7, 8, 10, 12- 

17, and 29-34 are dependent upon independent claim 1 and thus 

inherently incorporate all of the limitations of independent 

claim 1. Also, the secondary reference (i.e., Tajalli) fails to 

disclose, or even suggest, the deficiencies of the primary 

references as discussed above with respect to independent claim 

1. Indeed, the Examiner does not even assert such. Thus, the 

combination of the secondary reference with the primary 

references also fails to disclose, or even suggest, the 

deficiencies of the primary references as discussed above with 

respect to independent claim 1. Accordingly, claims 7, 8, 10, 

12-17, and 29-34 should be allowable over the combination of the 

secondary reference with the primary references at least by 

virtue of their dependency on independent claim 1. Moreover, 

claims 7, 8, 10, 12-17, and 29-34 recite additional features 

which are not disclosed, or even suggested, by the cited 

references taken either alone or in combination. 
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In view of the foregoing, Applicant respectfully requests 

that the aforementioned obviousness rejection of claims 7, 8, 

10, 12-17, and 29-34 be withdrawn. 

III. THE OBVIOUSNESS REJECTION OF CLAIMS 9, 11, 35, AND 36 

On pages 12-13 of the Office Action, claims 9, 11, 35 and 
36 were rejected under 35 U.S.C. § 103(a) as being unpatentable 
over U.S. Patent Application Publication No. US2003/0065926A1 to 
Schultz et al. ("Schultz") in view of U.S. Patent No. 7,210,040 
to Jordan ("Jordan") further in view of U.S. Patent Application 
Publication No. US2005/0108562A1 to Khazan et al . ("Khazan"). 
This rejection is hereby respectfully traversed. 

Applicant respectfully submits that the aforementioned 
obviousness rejection of claims 9, 11, 35 and 36 has become moot 
in view of the deficiencies of the primary references (i.e., 
Schultz and Jordan) as discussed above with respect to 
independent claim 1. That is, claims 9, 11, 35 and 36 are 
dependent upon independent claim 1 and thus inherently 
incorporate all of the limitations of independent claim 1. 
Also, the secondary reference (i.e., Khazan) fails to disclose, 
or even suggest, the deficiencies of the primary references as 
discussed above with respect to independent claim 1. Indeed, 
the Examiner does not even assert such. Thus, the combination 
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of the secondary reference with the primary references also 

fails to disclose, or even suggest, the deficiencies of the 

primary references as discussed above with respect to 

independent claim 1. Accordingly, claims 9, 11, 35 and 36 

should be allowable over the combination of the secondary 

reference with the primary references at least by virtue of 

their dependency on independent claim 1. Moreover, claims 9, 

11, 35 and 36 recite additional features which are not 

disclosed, or even suggested, by the cited references taken 

either alone or in combination. 

In view of the foregoing, Applicant respectfully requests 

that the aforementioned obviousness rejection of claims 9, 11, 

35 and 36 be withdrawn. 

IV. CONCLUSION 

In view of the foregoing, Applicant respectfully submits 
that the present application is in condition for allowance, and 
an early indication of the same is courteously solicited. The 
Examiner is respectfully requested to contact the undersigned by 
telephone at the below listed telephone number, in order to 
expedite resolution of any issues and to expedite passage of the 
present application to issue, if any comments, questions, or 
suggestions arise in connection with the present application. 
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To the extent necessary, a petition for an extension of 
time under 37 CFR § 1.136 is hereby made. 

Please charge any shortage in fees due in connection with 
the filing of this paper, including extension of time fees, to 
Deposit Account No. 50-0206, and please credit any excess fees 
to the same deposit account. 




TEA/vrp 

Hunton & Williams LLP 
1900 K Street, N.W. 
Washington, D.C. 20006-1109 
Telephone: (202) 955-1500 
Facsimile: (202) 778-2201 

Date: December 14, 2009 
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